OpenSSL [PATCH]30-40% ECDSA performance improvement - OpenSSL 1.1

eva2000 · Aug 15, 2018

cheers @bassie patch worked
Code (Text):
cat /root/centminlogs/patch_opensslpatches_150818-012328.log

######################################################################
Patching OpenSSL 1.1.0i
######################################################################
30-40% performance improvement patch for ECDSA
https://community.centminmod.com/posts/57725/
######################################################################
/svr-setup/openssl-1.1.0i /svr-setup/openssl-1.1.0i
patch -p1 < /usr/local/src/centminmod/patches/openssl/OpenSSL1.1i-improve-ECDSA-sign-30-40.patch
patching file ECDSA-PATCH-CHANGELOG
patching file crypto/ec/asm/ecp_nistz256-armv8.pl
patching file crypto/ec/asm/ecp_nistz256-x86_64.pl
patching file crypto/ec/ec_err.c
patching file crypto/ec/ec_lcl.h
Hunk #2 succeeded at 553 (offset 16 lines).
Hunk #3 succeeded at 629 (offset 16 lines).
patching file crypto/ec/ec_lib.c
Hunk #1 succeeded at 257 (offset 1 line).
Hunk #2 succeeded at 964 (offset 5 lines).
Hunk #3 succeeded at 1009 (offset 5 lines).
patching file crypto/ec/ecdsa_ossl.c
Hunk #1 succeeded at 144 with fuzz 2 (offset -9 lines).
patching file crypto/ec/ecp_nistz256.c
Hunk #3 succeeded at 1488 (offset -16 lines).
Hunk #4 succeeded at 1720 (offset -16 lines).
patching file crypto/perlasm/x86_64-xlate.pl
patching file include/openssl/ec.h
/svr-setup/openssl-1.1.0i
benchmarks before and after patching
Code (Text):
/opt/openssl/bin/openssl version -a
OpenSSL 1.1.0i  14 Aug 2018
built on: reproducible build, date unspecified
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: ccache gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/opt/openssl\"" -DENGINESDIR="\"/opt/openssl/lib/engines-1.1\""  -Wa,--noexecstack
OPENSSLDIR: "/opt/openssl"
ENGINESDIR: "/opt/openssl/lib/engines-1.1"
On Intel Xeon E3-1270v1 4CT/8T dedicated server with 16GB RAM and 240GB SSD

before patching OpenSSL 1.1.0i

nginx -V
nginx version: nginx/1.15.2 (150818-013141)
built by gcc 7.3.1 20180303 (Red Hat 7.3.1-5) (GCC)
built with OpenSSL 1.1.0i 14 Aug 2018
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=150818-013141 --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.42 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0i --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...
Code (Text):
/opt/openssl/bin/openssl speed -multi 8 rsa2048 ecdsap256

OpenSSL 1.1.0i  14 Aug 2018
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: ccache gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/opt/openssl\"" -DENGINESDIR="\"/opt/openssl/lib/engines-1.1\""  -Wa,--noexecstack
                  sign    verify    sign/s verify/s
rsa 2048 bits 0.000270s 0.000008s   3710.0 127752.2
                              sign    verify    sign/s verify/s
 256 bit ecdsa (nistp256)   0.0000s   0.0000s  86956.5  34483.7
after patching OpenSSL 1.1.0i

nginx -V
nginx version: nginx/1.15.2 (150818-012456)
built by gcc 7.3.1 20180303 (Red Hat 7.3.1-5) (GCC)
built with OpenSSL 1.1.0i 14 Aug 2018
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=150818-012456 --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.42 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0i --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...
Code (Text):
/opt/openssl/bin/openssl speed -multi 8 rsa2048 ecdsap256

OpenSSL 1.1.0i  14 Aug 2018
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: ccache gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/opt/openssl\"" -DENGINESDIR="\"/opt/openssl/lib/engines-1.1\""  -Wa,--noexecstack
                  sign    verify    sign/s verify/s
rsa 2048 bits 0.000270s 0.000008s   3696.9 128008.2
                              sign    verify    sign/s verify/s
 256 bit ecdsa (nistp256)   0.0000s   0.0000s 121212.1  37736.7
ECDSA performance patch has +39.39% faster ECDSA signs/s and +9.43% faster ECDSA verify/s . Of course newer cpus will have better ECDSA performance but patch boost is nice

OpenSSL 1.1.0i before vs after ECDSA Performance Patch rsa 2048 signs/s rsa 2048 verify/s ecdsa 256bit signs/s ecdsa 256bit verify/s

OpenSSL 1.1.0i before ECDSA patch 3710.0 127752.2 86956.5 34483.7

OpenSSL 1.1.0i after ECDSA patch 3696.9 128008.2 121212.1 37736.7

buik · Aug 15, 2018

Nice to hear that the up-to-date patch is working as it should be

rdan · Aug 15, 2018

bassie said: ↑

as i am not using OpenSSL anymore
Click to expand...

Sad for us using your patch for openssl 1.1.0.

eva2000 · Aug 15, 2018

rdan said: ↑

Sad for us using your patch for openssl 1.1.0.
Click to expand...

won't be needed after openssl 1.1.1 as that has ECDSA performance improvement patch added natively

buik · Aug 16, 2018

rdan said: ↑

Sad for us using your patch for openssl 1.1.0.
Click to expand...

No problem. There is always someone to test the code with test sites for example @eva2000

buik · Aug 16, 2018

What about the other patch from around the same time? Does it also still works fine? openssl-1.1/OpenSSL1.1h-double-performance-ecdhx-25519.patch · openssl-patch · buik / openssl · GitLab

eva2000 · Aug 16, 2018

bassie said: ↑

What about the other patch from around the same time? Does it also still works fine? openssl-1.1/OpenSSL1.1h-double-performance-ecdhx-25519.patch · openssl-patch · buik / openssl · GitLab
Click to expand...

Yeah that patch works fine still

buik · Aug 16, 2018

eva2000 said: ↑

Yeah that patch works fine still
Click to expand...

Ok gonna update the patch with the upscaled OpenSSL 1.1.0i version number.
Then it is clearer for visitors that it is compatible with the latest OpenSSL 1.1.0i.

Log in / Register

Forums

Learn about Centmin Mod LEMP Stack today

OpenSSL [PATCH]30-40% ECDSA performance improvement - OpenSSL 1.1

eva2000 Administrator Staff Member

before patching OpenSSL 1.1.0i

after patching OpenSSL 1.1.0i

buik “The best traveler is one without a camera.”

rdan Well-Known Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.

Log in / Register

Useful Searches

Learn about Centmin Mod LEMP Stack today

OpenSSL [PATCH]30-40% ECDSA performance improvement - OpenSSL 1.1

eva2000 Administrator Staff Member

before patching OpenSSL 1.1.0i

after patching OpenSSL 1.1.0i

buik “The best traveler is one without a camera.”

rdan Well-Known Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.